Pinned Tweet
7 months building a bootstrapped fintech
1) the hidden treasury
so far, we’ve been playing a game in which the end goal is to find that secret location
most of the assumptions we had about “where the money is” werent exactly right
Dolafy’s been profitable since our very first month live, mainly because we had a great network of digital entrepreneurs
but since then, we’ve been onboarding all kind of niches to actually understand who’s holding the map for the treasury
unfortunately, no podcasts, courses or friends could pin point where that location is
so we have to find it on our own
2) offboarding bad clients
during this exploration period, it was clear to us that some clients didnt really need our services
some were just shopping better fees with no real need for a long term relationship
others were trying to see if their fake ids would pass our detection system to run their schemes
plus the ones who promised millions and after a lot of support work ended up moving pennies
all those scenarios were really important to open our eyes about what works vs not
and now that we hit 300 clients onboarded, we have a much better sense of who they might be
3) not important/export
our biggest bet was on companies in need of paying suppliers all over the world - or getting paid in multiple currencies
i mean, there’s obviously a lot of money in the import and export world, and we wanted a small piece of it
but what we didnt realize is how troublesome these industries are, especially when trying to do banking for them
it’s a really hard client to move money for, with fierce competition and high compliance risks
if we had a proper banking license, which isnt the case, things would be much easier
but the current way this industry operates (SWIFT payments, mainly), it’s really hard for us to have a real impact
to do something that we would actually be proud of
so we stopped going after them and designing our product for these companies for now
4) digital marketers
that change gave us more space to decide the most scalable niche for Dolafy
(which could potentially guide us towards finding the hidden treasury faster)
so we decided to start focusing exactly on the niche our top 10 customers are: digital marketing
we have large accounts spending millions on ads every month with our cards
and then getting paid by platforms like google, shopify, etc
these marketers are great customers for us, not only because we speak the same digital language
but because we can actually improve a lot their experience, with our modern technology
we have the exact painkillers they need, and our competitors are doing a very bad job
so we decided to double down on media buyers, marketing agencies, marketplace owners, platform sellers etc…
i mean, i’m a digital entrepreneur myself, started making money online in 1997 (!!), so i know a thing or two about this world
maybe the treasury was right in front of our faces all this time?
5) partnerships
most players in the fintech space heard about us (“these 2 clowns and a bunch of robots built all this? no way!”)
and thanks to that, we now have an amazing list of partners to support us
companies that I personally admired for years, now their CEO is in my inbox helping us
Dolafy is formally connected to the main blockchains, yield projects, payments providers, digital banks, cards issuers, etc
and now that these important people are listening to us, we are actually able to do the changes our industry always needed
(we are launching soon the best onboarding experience that ever existed in the neobank space, thanks to that relationship with our partners)
very very excited for this one more month of @dolafycom live and all the changes it’ll bring to us
PS: if we find the treasury, there will be signs - stay tuned!
1) the hidden treasury
so far, we’ve been playing a game in which the end goal is to find that secret location
most of the assumptions we had about “where the money is” werent exactly right
Dolafy’s been profitable since our very first month live, mainly because we had a great network of digital entrepreneurs
but since then, we’ve been onboarding all kind of niches to actually understand who’s holding the map for the treasury
unfortunately, no podcasts, courses or friends could pin point where that location is
so we have to find it on our own
2) offboarding bad clients
during this exploration period, it was clear to us that some clients didnt really need our services
some were just shopping better fees with no real need for a long term relationship
others were trying to see if their fake ids would pass our detection system to run their schemes
plus the ones who promised millions and after a lot of support work ended up moving pennies
all those scenarios were really important to open our eyes about what works vs not
and now that we hit 300 clients onboarded, we have a much better sense of who they might be
3) not important/export
our biggest bet was on companies in need of paying suppliers all over the world - or getting paid in multiple currencies
i mean, there’s obviously a lot of money in the import and export world, and we wanted a small piece of it
but what we didnt realize is how troublesome these industries are, especially when trying to do banking for them
it’s a really hard client to move money for, with fierce competition and high compliance risks
if we had a proper banking license, which isnt the case, things would be much easier
but the current way this industry operates (SWIFT payments, mainly), it’s really hard for us to have a real impact
to do something that we would actually be proud of
so we stopped going after them and designing our product for these companies for now
4) digital marketers
that change gave us more space to decide the most scalable niche for Dolafy
(which could potentially guide us towards finding the hidden treasury faster)
so we decided to start focusing exactly on the niche our top 10 customers are: digital marketing
we have large accounts spending millions on ads every month with our cards
and then getting paid by platforms like google, shopify, etc
these marketers are great customers for us, not only because we speak the same digital language
but because we can actually improve a lot their experience, with our modern technology
we have the exact painkillers they need, and our competitors are doing a very bad job
so we decided to double down on media buyers, marketing agencies, marketplace owners, platform sellers etc…
i mean, i’m a digital entrepreneur myself, started making money online in 1997 (!!), so i know a thing or two about this world
maybe the treasury was right in front of our faces all this time?
5) partnerships
most players in the fintech space heard about us (“these 2 clowns and a bunch of robots built all this? no way!”)
and thanks to that, we now have an amazing list of partners to support us
companies that I personally admired for years, now their CEO is in my inbox helping us
Dolafy is formally connected to the main blockchains, yield projects, payments providers, digital banks, cards issuers, etc
and now that these important people are listening to us, we are actually able to do the changes our industry always needed
(we are launching soon the best onboarding experience that ever existed in the neobank space, thanks to that relationship with our partners)
very very excited for this one more month of @dolafycom live and all the changes it’ll bring to us
PS: if we find the treasury, there will be signs - stay tuned!
six months live. and Dolafy is skyrocketing.
1) over 200 clients live. onboarding 5 new businesses per day (from ~10 daily leads).
we haven't really nailed any distribution channel, and counterintuitively, signups keep happening non-stop
it really feels like a snowball effect. few friends' businesses, they recommended others, and so on...
onboarding is still the slowest part of the process, but we are fighting really hard to make it as smooth as possible
how? with our AI agents and a whole new level of never-seen-before automation
2) Mark
when a customer onboards Dolafy, we now have 2 fantastic AI agents doing a really cool job for them
first Mark, our compliance agent, he starts screening clients as soon as they submit their docs
Mark reads everything and tries to understand whatever the customer uploaded/typed
(it takes around 15 minutes to check a business, from identifying if it really exists, if numbers make sense, to searching for adverse media related to the business and its owners - it's AMAZING to watch)
if not satisfied, Mark will request more docs/answers right away for the customers
when new docs are uploaded, it goes straight back to Mark, which will analyze them again
(Mark is ready to deal with hundreds of customers at the same time)
this is a really simplified explanation of his job, but there's a really complex compliance setup happening in the background, fully AI-driven and in-house built by myself
if any red flags are found, Mark opens a case for a human to analyze (hello!)
or if all good, with our approval, he sends the case to Helly, our onboard agent, and she'll take it from there
3) Helly
she decides what's the best bank for our client, depending on numerous factors like niche, incorporation country (and state, if in the US), etc
Crossriver Bank? JP Morgan? HSBC? Citi? Erebor? Banking Circle? Helly knows what's best for each client, and will open a virtual bank account there
partner bank asked for more docs? no problem, Helly will contact the customer right away and ask
after approved, she'll inform the client so they can finally start moving money crossborder
but the automation doesn't stop there. client needs to send/receive money from a different country?
they just click one button at our dashboard and Helly will get them a virtual account in that specific currency (EUR, AED, GBP, BRL, etc)
4) other robots
- Harmony: managing our marketing, editing landing pages, ads campaigns, email funnels, all through Slack
- Burd: news guy, he keeps us informed about everything that happens to any partners we use (for security, new products, etc)
- Casey: tracks our to-dos, if we miss any important task, she'll follow up with us next morning to make sure we don't miss it
- Dylan: our finance agent, not yet implemented, but he'll be in charge of invoices, expenses, revenue, etc
- Natalie: she's able to read and answer emails, interact on the live chat, and other support stuff
(she's not active yet, as we still like to talk directly to our customers at this stage)
5) ... and 2 humans
myself and my partner are the only not-so-AI managing Dolafy, a bootstrapped neobank
even though we are profitable and could hire someone, there's really no need right now
all tasks are being handled really really well by our team of agents, and whenever we see a task being repeated too often, we just automate it
2 persons will always be there, managing the 7 agents we have in place, and doing whatever tasks are still not replaceable by robots
(after all, fintech is a strictly regulated industry, and we still need to follow a bunch of AML rules)
but in my opinion, this is a huge shift on how businesses can be managed in 2026 - the true potential of AI at work
pretty cool right?
so yeah... stay tuned for more news about the first AI-first fintech ever built on planet earth!
PS: we now have a really cool office in Floripa! let us know if you are around and need an international bank you can trust for your business
6
3
49
5,650
i've been running pentests at my fintech for the last 4 days
i'm mainly using open source uncensored AI (or abliterated if you want to get fancy)
models like glm-5.3, deepseek-v4.1-flash and others i'd rather not disclose
all I can tell you is: brace for impact
hackers can now deploy swarms of agents trying to hack the whole internet, fully automated
just like google spiders read the web to find sites for indexing on search, bots can now find vulnerabilities on anything that is plugged to the internet
i mean, sure, this always happened before - but they were using ready-made scripts for the process, kinda hit or miss, focusing on lame things
now, we have SI models investing a ton of energy on EACH and EVERY site they target, increasing exponentially the odds of finding open doors to exploit
if you ask me: is your fintech safe?
today, yes. i think so. i've improved everything i've found so far.
but tomorrow?
i'll be very honest: i have no idea
what if they hack my HOSTING PROVIDER tomorrow?
what if they hack 1password or aws security keys or infisical or github?
what if they hack the ISP I use to access the internet?
or even if they hack the police drones in my city and fly over my office to try to take us over via bluetooth connections?
it's very naive of anyone believing their systems are secure
you might feel safe today, until a new LLM model arrives and find gaps that didn't even exist before
i've been saying for months that, at some point, everything would become hackable
and I can assure you one thing: that point has been defined as Oct/2026
fasten your seat belts, the pilot went offline
i'm mainly using open source uncensored AI (or abliterated if you want to get fancy)
models like glm-5.3, deepseek-v4.1-flash and others i'd rather not disclose
all I can tell you is: brace for impact
hackers can now deploy swarms of agents trying to hack the whole internet, fully automated
just like google spiders read the web to find sites for indexing on search, bots can now find vulnerabilities on anything that is plugged to the internet
i mean, sure, this always happened before - but they were using ready-made scripts for the process, kinda hit or miss, focusing on lame things
now, we have SI models investing a ton of energy on EACH and EVERY site they target, increasing exponentially the odds of finding open doors to exploit
if you ask me: is your fintech safe?
today, yes. i think so. i've improved everything i've found so far.
but tomorrow?
i'll be very honest: i have no idea
what if they hack my HOSTING PROVIDER tomorrow?
what if they hack 1password or aws security keys or infisical or github?
what if they hack the ISP I use to access the internet?
or even if they hack the police drones in my city and fly over my office to try to take us over via bluetooth connections?
it's very naive of anyone believing their systems are secure
you might feel safe today, until a new LLM model arrives and find gaps that didn't even exist before
i've been saying for months that, at some point, everything would become hackable
and I can assure you one thing: that point has been defined as Oct/2026
fasten your seat belts, the pilot went offline
6
0
47
4,281
everyone is always so late to building things
because they try to get ideas from social media
instead of connecting the dots internally
the answers to your life are already coded inside your brain
you only look for new answers if you are trying a totally new perspective that you haven’t experienced before in life
but keep in mind that will take years
and after learning all that, you shouldnt restart the search one more time, you should finally use what you learned:
by connecting the dots, internally.
because they try to get ideas from social media
instead of connecting the dots internally
the answers to your life are already coded inside your brain
you only look for new answers if you are trying a totally new perspective that you haven’t experienced before in life
but keep in mind that will take years
and after learning all that, you shouldnt restart the search one more time, you should finally use what you learned:
by connecting the dots, internally.
1
1
32
1,594
amazing. someone from eToro copy-pasted their App Store rejection message on the “What’s New” tab - and it actually got approved lol
apps.apple.com/ge/app/etoro-t…
apps.apple.com/ge/app/etoro-t…
2
0
12
3,956
before, we used cloudflare to protect our servers from DDoS
now, we use cloudflare to protect our servers from AI exploits
ty @Cloudflare - you've been a great partner so far
now, we use cloudflare to protect our servers from AI exploits
ty @Cloudflare - you've been a great partner so far
1
0
21
2,425
right after posting this, i got a warning that nodejs was exploited
had to stop everything i was doing and patching it asap
craaaazy times
nodejs.org/en/blog/vulner…
had to stop everything i was doing and patching it asap
craaaazy times
nodejs.org/en/blog/vulner…
i used to run updates every month on my tech
then I moved to weekly updates
today, i'm basically running osv scanners, dependabot and checking for high priority patches every HOUR
also, before applying any package/library updates, my agents must check all signatures and updates on the code to avoid compromised ones
(we give a 7d cooldown period for some of them)
the way things are getting hacked, i'll probably need to check every minute if a new exploit might affect my system
and i'm not even joking...
0
0
1
1,075
i used to run updates every month on my tech
then I moved to weekly updates
today, i'm basically running osv scanners, dependabot and checking for high priority patches every HOUR
also, before applying any package/library updates, my agents must check all signatures and updates on the code to avoid compromised ones
(we give a 7d cooldown period for some of them)
the way things are getting hacked, i'll probably need to check every minute if a new exploit might affect my system
and i'm not even joking...
then I moved to weekly updates
today, i'm basically running osv scanners, dependabot and checking for high priority patches every HOUR
also, before applying any package/library updates, my agents must check all signatures and updates on the code to avoid compromised ones
(we give a 7d cooldown period for some of them)
the way things are getting hacked, i'll probably need to check every minute if a new exploit might affect my system
and i'm not even joking...
Two critical vulnerabilities have been identified in PHP, a widely used programming language that powers websites and web applications. These vulnerabilities (CVE-2026-109618 and CVE-2026-109619) could allow malicious cyber actors to remotely execute code in PHP core, potentially data and networks.
The FBI urges organizations to take the following steps now:
➡️ If an immediate update is not feasible it is recommended that organizations take the system offline until it can be fully mitigated.
➡️ Immediately update affected PHP installations following the guidance on php.net. Inventory where PHP runs in your environment, prioritizing internet-facing systems and vendor products that bundle PHP.
➡️ Monitor web servers for suspicious activity, including PHP processes unexpectedly launching command shells or downloading files. Ensure appropriate process-monitoring capabilities are in place to help identify potential exploitation.
➡️ If you find signs of compromise, isolate affected systems, preserve your web server and PHP logs, and report it to your local FBI field office or ic3.gov. Those reports help us identify the actors involved and warn other organizations before they become victims.
For the latest information, follow PHP’s announcement on php.net, CERT-EU Security Advisory 2026-018, and CISA’s Known Exploited Vulnerabilities catalog.
2
2
20
2,827
i remember in 2013 we had very similar protests in Sao Paulo to those that happened in Paris
my ex-girlfriend family had a shop downtown absolutely destroyed by the criminals
the protestors reason? bus tickets increase - which quickly expanded beyond transport costs into a l discontent
history does not repeat itself identically, but human behavior, ambitions, and systemic pressures cause events to "rhyme" across different eras
chaos ignites natural selection, which removes the weak and forces the ones who survive to be stronger - on both sides -, making the world better balanced for the next century
grab your popcorn and moisturize your fingers, more entertainment is coming to your tiny screens
my ex-girlfriend family had a shop downtown absolutely destroyed by the criminals
the protestors reason? bus tickets increase - which quickly expanded beyond transport costs into a l discontent
history does not repeat itself identically, but human behavior, ambitions, and systemic pressures cause events to "rhyme" across different eras
chaos ignites natural selection, which removes the weak and forces the ones who survive to be stronger - on both sides -, making the world better balanced for the next century
grab your popcorn and moisturize your fingers, more entertainment is coming to your tiny screens
1
1
20
1,496
i was wondering what’s gonna happen if AI models go offline or bankrupt
systems would start crashing, engineers wouldn’t be able to patch issues
companies would need hundreds of employees again to catch up with all the (vibed) code
most saas created in the AI era would probably have to stop operating, coz the owner has no idea how their scripts work
we will be absolutely dependent on super intelligence by next year - SI leaders will control the world
systems would start crashing, engineers wouldn’t be able to patch issues
companies would need hundreds of employees again to catch up with all the (vibed) code
most saas created in the AI era would probably have to stop operating, coz the owner has no idea how their scripts work
we will be absolutely dependent on super intelligence by next year - SI leaders will control the world
7
1
29
1,921
got an email today from a partner's compliance team saying:
"Your organizational chart lists the same individual, Eduardo Borges, as CTO, CCO, CPO, and CMO. This seems to be a mistake. Could you please fix it and resubmit?"
i mean... where do i even start?
"Your organizational chart lists the same individual, Eduardo Borges, as CTO, CCO, CPO, and CMO. This seems to be a mistake. Could you please fix it and resubmit?"
i mean... where do i even start?
12
1
308
56,087
it’s much easier to digest a high risk appetite when you arent being personally punished
at dolafy, im even afraid of onboarding clients that used a VPN lol
thankfully my compliance agents don’t really have a “too bit to jail” mindset, hope we can stay compliant and survive one more year
at dolafy, im even afraid of onboarding clients that used a VPN lol
thankfully my compliance agents don’t really have a “too bit to jail” mindset, hope we can stay compliant and survive one more year
Dear Secretary Bessent @SecScottBessent,
My name is Everett Stern. In 2010 I was a compliance officer at @HSBC. From a back office in New Castle, Delaware, I watched billions of dollars move to drug cartels, sanctioned regimes, and terrorist organizations. The enemies of the United States. I documented it, I escalated it, and when the bank would not act, I took it to the @FBI, the @CIA, and eventually the @SECGov.
The result was a $1.92 billion settlement. At the time, it was one of the largest in American history. It was also about five weeks of the bank’s profit. Not one banker was charged. Not one went to prison.
I paid a different price. I lost my career, my savings, and my place in the industry I had trained for. I was blacklisted. Every door in American finance closed at once. I slept on a camping cot in a 300 square foot apartment because I could not afford a bed, and I waited tables at @PFChangs to eat. I tell you this not for sympathy, but so you understand that I know exactly what it costs to do the right thing in American finance, and exactly how little the system does in return.
I made that sacrifice because I believed it would change something.
Yesterday, your department fined @BankofAmerica $1.2 billion for failing to report more than $5 billion in suspicious transactions, some of it tied by your own findings to Chinese laundering networks, narcotics, and the southwest border, alongside 475 apparent sanctions violations touching Russia, Iran, and global terrorism. The bank admitted it willfully violated the Bank Secrecy Act.
Fourteen years after HSBC. A bank with “America” in its name. And once again, not one individual charged.
Secretary Bessent, I want to say plainly what I believe you already know. The fines are not working.
A fine is paid by shareholders, absorbed by the balance sheet, and forgotten by the next earnings call. Bank of America reported earnings this morning. Nobody who set the alert thresholds, nobody who decided the 2024 cease and desist could wait, nobody who chose the backlog over the law will lose a single thing they value. Their lives are untouched. That is the entire reason the behavior repeats.
This is money laundering. This is blood money. Money that reaches a cartel buys fentanyl that kills Americans. Money that reaches a terrorist organization buys the next attack. This country has fought a war on drugs and a war on terror for decades, at enormous cost in lives and treasure, and all the while we have allowed the financing to flow through institutions we charter and regulate. Cut off the money and we win. We have never seriously tried.
There is also a question of equal justice that I cannot let go.
Before I walked into the FBI building to report HSBC, I stopped in front of the Great Seal on the wall and read the words engraved beneath it: “Justice is the defense of our liberty.” I believed that. I still want to. But every day in this country, people go to prison for crimes that are nothing next to moving money for the people who want Americans dead. A suit, a title, and a corporate badge should not be a shield from the consequences that apply to everyone else. If a street dealer goes to prison for what he sells, the banker who moved the cartel’s money should be standing next to him.
I also want to raise something that is rarely said in these conversations. Why has no one inside Bank of America come forward the way I did? The answer is that everyone in American banking knows what happened to me, and to the whistleblowers who came after. The last person who spoke up is the only policy anyone believes. That is a culture problem, and it starts with leadership, in the banks and in the agencies that regulate them.
This is not a political issue. It has spanned administrations of both parties. It is a national security issue, and I am asking you to treat it as one.
Three things would change the math overnight.
Refer individuals for criminal prosecution. Not the analyst in the queue. The executives who set the thresholds and chose the risk. One banker in handcuffs would do more than every fine in Treasury’s history combined.
End “too big to jail.” An institution cannot be too big to fail and too big to jail at the same time. If it is the first, it must be held to a higher standard, not a lower one.
And if Bank of America will not act as America’s bank, review its charter. A national charter is a privilege granted on behalf of the American people. It should be conditioned on not moving money for the people trying to kill them.
Secretary Bessent, you said yesterday that these actions send a clear message that even the biggest institutions are not above the law. With respect, the institution was never the problem. The people inside it are above the law, and they know it. Until that changes, I will keep writing letters like this one, and the next bank will keep paying the next fine.
I gave up everything I had to stop this. I am asking you to use the power you have to finish it.
Respectfully,
Everett A. Stern
HSBC Whistleblower
Founder and Intelligence Director, Tactical Rabbit
1
0
8
1,058
i've been investing a lot of energy on improving my body recently
(already upgraded my mind's software over the last years, now making sure the body follows it)
i've completely removed bad physical habits AND lower quality food from my routine - reaching the healthiest level I've ever been
the reason? to be able to enjoy this absolutely fantastic new world that is forming right in front of us, without any health-related disruptions
treat your hardware well, you'll need it more than ever
(already upgraded my mind's software over the last years, now making sure the body follows it)
i've completely removed bad physical habits AND lower quality food from my routine - reaching the healthiest level I've ever been
the reason? to be able to enjoy this absolutely fantastic new world that is forming right in front of us, without any health-related disruptions
treat your hardware well, you'll need it more than ever
3
0
56
1,997
Google, Meta and Microsoft
those are the companies I think will win the AI race
Google, because people already give them content for for free - they don't have to fight with scraping at all
Meta because they have access to most online conversation in the world to train their models
and Microsoft because of Github, which basically holds all the code created by humans on the planet
Apple could be on the list as well, but I think their game is still hardware, not software
(and i personally think their OS will lose space to other open source ones soon, people will go for simpler devices while cloud agents to the hard work)
companies like OpenAI and Anthropic don't really have that same advantage, they were just earlier and faster
AWS and SpaceX might stay ahead because of the data centers they own, but nothing compared to Google
but those are just guesses... let's check this again in 5y from now
those are the companies I think will win the AI race
Google, because people already give them content for for free - they don't have to fight with scraping at all
Meta because they have access to most online conversation in the world to train their models
and Microsoft because of Github, which basically holds all the code created by humans on the planet
Apple could be on the list as well, but I think their game is still hardware, not software
(and i personally think their OS will lose space to other open source ones soon, people will go for simpler devices while cloud agents to the hard work)
companies like OpenAI and Anthropic don't really have that same advantage, they were just earlier and faster
AWS and SpaceX might stay ahead because of the data centers they own, but nothing compared to Google
but those are just guesses... let's check this again in 5y from now
google has an almost absurd structural advantage in personal ai.
chrome knows what you browse. android/gmail knows who you communicate with. calendar knows your commitments. maps knows where you go. photos knows your memories. youtube knows your interests. docs knows what you create. android knows what you do on your phone.
almost every important dimension of personal context already exists inside google.
which is why it's pretty remarkable that there is just no unifying ai product in place that works to make all of this work & work well. with clarity & simplicity.
instead google is effectively powering all personal ai products including meta.
2
0
15
2,353
